10442 matches found
Login Lockdown < 2.07 - Administrator+ SQL Injection
Description The plugin is vulnerable to SQL Injection via the ‘sort order and limit’ parameter due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
PT-2024-20220 · Eserver · Ezserver
Name of the Vulnerable Software and Affected Versions: EzServer version 6.4.017 Description: The issue allows a denial of service daemon crash via a long string, such as one for the RNTO command. Recommendations: For EzServer version 6.4.017, consider restricting the length of input strings to...
CLSA-2024-1706027577 squid34: Fix of CVE-2023-50269
CVE-2023-50269: Limit the number of allowed X-Forwarded-For hops to prevent DoS...
CLSA-2024-1706026564 squid: Fix of CVE-2023-50269
CVE-2023-50269: Limit the number of allowed X-Forwarded-For hops to prevent DoS...
CLSA-2024-1706026402 squid34: Fix of CVE-2023-50269
CVE-2023-50269: Limit the number of allowed X-Forwarded-For hops to prevent DoS...
PT-2024-15192 · WordPress · Wpforms Pro
Name of the Vulnerable Software and Affected Versions: WPForms Pro versions up to, and including, 1.8.5.3 Description: The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters due to insufficient input sanitization and output escaping. This...
pyload Clickjacking
The vulnerability of the software for downloading pyload files is related to improper restrictions on the number of layers or frames that can be displayed in the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...
PT-2024-1155 · Oracle · Oracle Audit Vault/Database Firewall
Name of the Vulnerable Software and Affected Versions: Oracle Audit Vault and Database Firewall versions 20.1 through 20.9 Description: The issue is related to insufficient input validation in the Firewall component of Oracle Audit Vault and Database Firewall, allowing a remote attacker to gain...
EulerOS Virtualization 2.10.1 : bind (EulerOS-SA-2023-2911)
According to the versions of the bind packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it h...
EulerOS 2.0 SP10 : dhcp (EulerOS-SA-2023-3204)
According to the versions of the dhcp package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sent...
EulerOS 2.0 SP10 : bind (EulerOS-SA-2023-2802)
According to the versions of the bind packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Every named instance configured to run as a recursive resolver maintains a cache database holding the responses to the queries it has recently sen...
PT-2024-1461 · Tenda · Tenda W9
Name of the Vulnerable Software and Affected Versions: Tenda W9 version 1.0.0.74456 Description: The issue is related to a critical vulnerability in the setWrlBasicInfo function of the httpd component. This vulnerability allows for a stack-based buffer overflow due to the manipulation of the...
GHSA-CHCR-X7HC-8FP8 Devise-Two-Factor vulnerable to brute force attacks
Advisory withdrawn The backing CVE has been rejected Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2F...
Devise-Two-Factor vulnerable to brute force attacks
Advisory withdrawn The backing CVE has been rejected Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2F...
Devise-Two-Factor vulnerable to brute force attacks
Devise-Two-Factor does not throttle or otherwise restrict login attempts at the server by default. When combined with the Time-based One Time Password algorithm's TOTP inherent entropy limitations, it's possible for an attacker to bypass the 2FA mechanism through brute-force attacks. Impact If a...
CVE-2023-6934
The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2023-6934 Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Limit Login Attempts Reloaded plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 2.25.26 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
PHPJabbers Event Booking Calendar Security Vulnerability
PHPJabbers Event Booking Calendar is an event calendar application. A security vulnerability exists in PHPJabbers Event Booking Calendar version 4.0, which stems from the presence of multiple lost rate limit vulnerabilities...
PHPJabbers Hotel Booking System Security Vulnerability
Hotel Booking System is a hotel booking system. A security vulnerability exists in PHPJabbers Hotel Booking System version 4.0, which stems from the presence of a lost rate limit vulnerability...
PHPJabbers Event Booking Calendar Security Vulnerability
PHPJabbers Event Booking Calendar is an event calendar application. A security vulnerability exists in PHPJabbers Event Booking Calendar version 4.0, which stems from the presence of multiple lost rate limit vulnerabilities...